dcfldd

Create disk image with progress

$ dcfldd if=[/dev/sda] of=[disk.img]

$ dcfldd if=[/dev/sda] of=[disk.img] hash=md5 hashlog=[hash.txt]

$ dcfldd if=[/dev/sda] of=[disk.img] hash=md5,sha256

$ dcfldd if=[/dev/sda] of=[disk1.img] of=[disk2.img]

$ dcfldd if=[/dev/sda] of=[disk.img] split=[1G] splitformat=aa

$ dcfldd pattern=[00] of=[/dev/sda]

$ dcfldd if=[/dev/sda] vf=[disk.img]

$ dcfldd if=[/dev/sda] of=[disk.img] statusinterval=[256]

dcfldd [options]

dcfldd is an enhanced version of GNU dd developed by the Department of Defense Computer Forensics Lab (DCFL). It adds features critical for forensic imaging, including on-the-fly hashing, status output, split output, and verification.
The tool can compute multiple hash types (MD5, SHA1, SHA256, etc.) while copying, ensuring data integrity. It supports writing to multiple outputs simultaneously for creating duplicate forensic images.
dcfldd provides progress output during copying, addressing one of dd's most common complaints. It's widely used in digital forensics, incident response, and data recovery operations.

if= file

Input file or device.

Output file (can specify multiple).

Verify file against input.

Hash algorithm(s) (md5, sha1, sha256, sha384, sha512).

Write hash to file.

Hash every n bytes.

Fill pattern for wiping.

Split output at size intervals.

Split file suffix format.

Show status every n blocks.

Block size for read/write.

Copy only n blocks.

Skip n blocks at start of input.

Skip n blocks at start of output.

Conversion options (noerror, sync, etc.).

Slower than dd due to hashing overhead. Hash verification requires reading data twice. Forensic imaging should use write blockers on source media. Some features may behave differently than standard dd.

dcfldd was developed by Nick Harbour at the Department of Defense Computer Forensics Laboratory (DCFL) in the early 2000s. It was created to address the needs of forensic investigators who required verifiable, documented disk imaging capabilities. The tool became a standard in digital forensics training and practice.

dd(1), ddrescue(1), dc3dd(1), md5sum(1)